Section 43: the ten acts that carry compensation
Section 43 applies to any person who, without permission of the owner or any other person in charge of a computer, computer system or computer network, does any of ten acts. A person who does so is liable to pay damages by way of compensation to the person affected. The section is in Chapter IX, which deals with penalties, compensation and adjudication, and it does not by itself create a crime.
| Clause | The act |
|---|---|
| (a) | Accessing or securing access to a computer, computer system, network or computer resource without permission |
| (b) | Downloading, copying or extracting data, a database or information from it, including from a removable storage medium |
| (c) | Introducing a computer contaminant or computer virus |
| (d) | Damaging the computer, system, network, data, database or programmes |
| (e) | Disrupting the computer, system or network |
| (f) | Denying access to a person authorised to access it |
| (g) | Assisting any person to facilitate access in contravention of the Act, rules or regulations |
| (h) | Charging the services availed of by a person to the account of another by tampering with or manipulating the system |
| (i) | Destroying, deleting or altering information residing in a computer resource, or diminishing its value or utility or affecting it injuriously by any means |
| (j) | Stealing, concealing, destroying or altering computer source code used for a computer resource with intent to cause damage |
The explanation to the section defines the terms. A computer contaminant is any set of computer instructions designed to modify, destroy, record or transmit data or programmes in a computer, system or network, or by any means to usurp its normal operation. A computer virus is any computer instruction, information, data or programme that destroys, damages, degrades or adversely affects the performance of a computer resource or attaches itself to another computer resource and operates when a programme, data or instruction is executed. A computer database is a representation of information, knowledge, facts, concepts or instructions in text, image, audio or video prepared in a formalised manner for use in a computer, system or network.
Sections 65, 66 and 66B: the criminal side
Section 66 turns the acts in section 43 into an offence when the person acts dishonestly or fraudulently, and it is punishable with imprisonment up to three years, or fine up to Rs 5 lakh, or both. Section 65 is separate and protects computer source code that is required by law to be kept or maintained. Section 66B punishes a person who dishonestly receives or retains a stolen computer resource or communication device, knowing or having reason to believe it to be stolen.
| Section | Nature | Conduct | Consequence |
|---|---|---|---|
| Section 43 | Civil: damages by way of compensation to the person affected | Any person, without permission of the owner or person in charge, who does any of the acts in clauses (a) to (j) | Adjudicating officer for claims up to Rs 5 crore; a court above that |
| Section 65 | Criminal | Knowingly or intentionally concealing, destroying or altering computer source code that the law requires to be kept or maintained | Imprisonment up to three years, or fine up to Rs 2 lakh, or both |
| Section 66 | Criminal | Dishonestly or fraudulently doing any act in section 43 | Imprisonment up to three years, or fine up to Rs 5 lakh, or both |
| Section 66B | Criminal | Dishonestly receiving or retaining a stolen computer resource or communication device, knowing or having reason to believe it to be stolen | Imprisonment up to three years, or fine up to Rs 1 lakh, or both |
The difference between sections 43 and 66 is the mental element. Under section 43 a person pays compensation for the listed acts done without permission, and under section 66 the same acts done dishonestly or fraudulently are punished. A single incident, such as copying a database from an employer’s server, can give rise to a claim for compensation and a criminal complaint at the same time.
Who decides a claim for compensation
Section 46 provides for an adjudicating officer, appointed by the Central Government, who is not below the rank of a Director to the Government of India or an equivalent officer of a State Government, and who must have experience in information technology and legal or judicial experience. The adjudicating officer decides matters in which the claim for damage does not exceed Rs 5 crore, and where it exceeds Rs 5 crore the jurisdiction vests in the competent court. The words “injury or” were omitted from section 46(1A), and “under this Chapter” replaced by “under this Act” in section 46(1), by the Jan Vishwas (Amendment of Provisions) Act, 2023. After giving the person a reasonable opportunity to make a representation, the officer may award such compensation as is thought fit. The officer has the powers of a civil court that the Act confers on the Appellate Tribunal, and under section 57 a person aggrieved by an order of the adjudicating officer may appeal to the Appellate Tribunal within forty-five days of receiving a copy of the order, except against an order made with the consent of the parties.
Where these sections meet the Sanhita and the data protection law
The Bharatiya Nyaya Sanhita covers the general offences that can accompany a computer offence, such as cheating and forgery, and their numbers are on the page on IPC to BNS. The liability of an organisation for failing to protect data was once in section 43A of the IT Act, and section 44(2)(a) of the Digital Personal Data Protection Act provides that section 43A is omitted, as described on the page on the DPDP Act 2023. The list of the main IT Act offences with their penalties is on the page on the IT Act 2000.
Frequently asked questions
What is the difference between section 43 and section 66 of the IT Act?
Section 43 lists acts done without permission, such as accessing a computer, copying data, introducing a virus or denying access, and it makes the person liable to pay compensation to the person affected. Section 66 makes the same acts a criminal offence when they are done dishonestly or fraudulently, punishable with imprisonment up to three years, or fine up to Rs 5 lakh, or both.
What is the punishment for hacking under the IT Act?
The Act does not use the word in these sections. Accessing a computer without permission is an act listed in section 43(a), which carries compensation, and when it is done dishonestly or fraudulently section 66 punishes it with imprisonment up to three years, or fine up to Rs 5 lakh, or both.
Who decides a claim for compensation under section 43?
An adjudicating officer, appointed by the Central Government under section 46 and not below the rank of a Director to the Government of India or an equivalent officer of a State Government. The adjudicating officer decides claims in which the damage does not exceed Rs 5 crore, and the competent court has jurisdiction above that.
What does section 65 of the IT Act protect?
Computer source code that the law requires to be kept or maintained. Concealing, destroying or altering it, knowingly or intentionally, or causing another to do so, is punishable with imprisonment up to three years, or fine up to Rs 2 lakh, or both. Source code means the listing of programmes, computer commands, design and layout and programme analysis of a computer resource in any form.
Does the IT Act cover data theft?
Section 43(b) covers downloading, copying or extracting data, a database or information from a computer without permission, and section 43(i) covers destroying, deleting or altering information. Section 66 makes these acts punishable when done dishonestly or fraudulently, and the Bharatiya Nyaya Sanhita offences, such as theft, may apply as well.